(bug 66776, bug 71478) SECURITY: User PleaseStand reported a way to inject code into API clients that used format=php to process pages that underwent flash policy mangling. This was fixed along with improving how the mangling was done for format=json, and allowing sites to disable the mangling using $wgMangleFlashPolicy.

(bug 70901) SECURITY: User Jackmcbarn reported that the ability to update the content model for a page could allow an unprivileged attacker to edit another user's common.js under certain circumstances. The user right "editcontentmodel" was added, and is needed to change a revision's content model.

(bug 72222) SECURITY: Do not show log action when the entry is revdeleted with DELETED_ACTION. NOTICE: this may be reverted in a future release pending a public RFC about the desired functionality. This issue was reported by user Bawolff.

(bug 71621) Make allowing site-wide styles on restricted special pages a config option.

$wgMangleFlashPolicy was added to make MediaWiki's mangling of anything that might be a flash policy directive configurable.

(bug 60719) In MediaWiki 1.22, the job queue execution on each page request was changed (Gerrit change 59797) so, instead of executing the job inside the same PHP process that's rendering the page, a new PHP cli command is spawned to execute runJobs.php in the background. It will only work if $wgPhpCli is set to an actual path or safe mode is off, otherwise, the old method will be used. https://www.mediawiki.org/wiki/Manual:Job_queue#Changes_introduced_in_MediaWiki_1.22 for more infomation. This change was in earlier releases of 1.22 but was not noted here until now.

(bug 63269) Email notifications were not correctly handling the MediaWiki:Helppage message being set to a full URL. This is a regression from the 1.22.5 point release, which made the default value for it a URL. If you customized MediaWiki:Enotif body (the text of email notifications), you'll need to edit it locally to include the URL via the new variable $HELPPAGE instead of the parser functions fullurl and canonicalurl; otherwise you don't have to do anything.

(bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted namespaces. Also disallow iframe elements. User will get an error including the namespace name if they use a non- whitelisted namespace.

(bug 61346) SECURITY: Make token comparison use constant time. It seems like our token comparison would be vulnerable to timing attacks. This will take constant time.

(bug 56931) Updated the plural rules to CLDR 24. They are in new format which is detailed in UTS 35 Rev 33. The PHP parser and evaluator as well as the JavaScript evaluator were updated to support the new format. Plural rules for some languages have changed, most notably Russian. Affected software messages have been updated and marked for review at translatewiki.net. This change is backported from the development branch of MediaWiki 1.23.

(bug 41729) Display editsection links next to headings. Also change their class name from .editsection to .mw-editsection and place them at the end of the heading element instead of the beginning. Client-side code and screen-scrapers will have to be adjusted to handle both cases (old HTML will still be visible on cached page renders until they are purged); extensions using the DoEditSectionLink or EditSectionLink hooks might need adjustments as well.

action=parse no longer returns all langlinks for the page with prop=langlinks by default. The new effectivelanglinks parameter will request that the LanguageLinks hook be called to determine the effective language links.

list=allpages, list=langbacklinks, and prop=langlinks do not apply the new LanguageLinks hook, and thus only consider language links stored in the database.

Implementation of MediaWiki's JS and JSON value encoding has changed:

MediaWiki no longer supports PHP installations in which the native JSON extension is missing or disabled.

XmlJsCode objects can no longer be nested inside objects or arrays. (For Xml::encodeJsCall(), this individually applies to each argument.)

The sets of characters escaped by default, along with the precise escape sequences used, have changed (except for the Xml::escapeJsString() function, which is now deprecated).

The Services_JSON class has been removed. If necessary, be sure to upgrade affected extensions at the same time (e.g. Collection).

Legacy skins Simple, MySkin, Chick, Standard and Nostalgia were all removed. (Nostalgia was moved to an extension.) The SkinLegacy and LegacyTemplate classes that supported them were removed as well and are now a part of the Nostalgia extension.

The "ExternalAuth" authentication subsystem was removed, along with its associated globals of $wgExternalAuthType, $wgExternalAuthConf, $wgAutocreatePolicy and $wgAllowPrefChange. Affected users are encouraged to use AuthPlugin for external authentication/authorization needs.

mw.util.tooltipAccessKeyRegexp: The match group for the accesskey character is now $6 instead of $5.

meta keywords are no longer supported. A <meta name="keywords" will no longer be output and OutputPage::addKeyword no longer exists.

The EditSectionLink hook was removed after being deprecated since MediaWiki 1.14. Use DoEditSectionLink instead.

(bug 50310) wikibits: Drop support for mwCustomEditButtons. It defaults to an empty array and emits mw.log.warn when accessed.

The 'mediawiki.legacy.wikiprintable' module has been removed. The skins/common/wikiprintable.css file no longer exists. Return value of Skin#commonPrintStylesheet is ignored. Please use the 'mediawiki.legacy.commonPrint' module instead or base your skin on SkinTemplate.

The module 'mediawiki.legacy.IEFixes' has been removed as it was unused. The file skins/common/IEFixes.js remains but is only used by wikibits. The file never contained any re-usable components. To use it in a skin, load 'mediawiki.legacy.wikibits' (which IEFixes depends on) and that will import IEFixes automatically if user agent conditions are met.

(bug 33454) Language::sprintfDate now has a timezone parameter, and supports the "eIOPTZ" formatting characters.

EditWarning: A warning is shown when an editor leaves the edit form without saving (enabled by default, users can opt-out via the 'useeditwarning' preference). This feature was moved from the Vector extension, and is now part of core for all skins. Take care when upgrading that you don't use an older version of the Vector extension as this feature may conflict.

New 'mediawiki.ui' CSS module providing mw-ui-* styles for buttons and a compact vertical form layout.

HTMLForm supports a new display format 'vform' which applies this compact vertical layout and button styling. Special:PasswordReset uses this format.

(bug 23343) Implemented ability to apply IP blocks to the contents of X-Forwarded-For headers by adding a new configuration variable $wgApplyIpBlocksToXff (disabled by default).

The new hook 'APIGetPossibleErrors' to modify the list of possible errors was added.

(bug 25592) LogEventsList::showLogExtract() will now ignore various Pager-related WebRequest parameters by default, as this is overwhelmingly likely to be what was intended by users of the method. If any caller wishes to use these parameters, the new param 'useRequestParams' may be set to true.

mw.util.addPortletLink: Tooltip is no longer required to be plain (without an accesskey in it already). As such it now rountrips. Creating a link with a message as tooltip, grabbing the title attribute and using it to create another portlet will work as expected.

(bug 6747) {{ROOTPAGENAME}} introduced, contains the name of the topmost page without namespace.

(bug 45535) introduced the new 'LanguageLinks' hook for manipulating the language links associated with a page before display.

HTMLForm will turn multiselect checkboxes into a Chosen interface when setting cssclass 'mw-chosen'

rebuildLocalisationCache learned --lang option. Let you rebuild l10n caches of the specified languages instead of all of them.

New GetNewMessagesAlert hook allowing extensions to disable or modify the new messages alert

New wgUserNewMsgRevisionId JS global for logged in users. This will be null if the user has no new talk page messages. Otherwise it will be set to the revision ID of the oldest new talk page message. This will allow gadgets and extensions to create their own new message alerts on the client side.

Rights used for the default protection levels ('sysop' and 'autoconfirmed') are now used just for that purpose, instead of overloading other rights. This allows easy granting of the ability to edit sysop-protected pages without also granting the ability to protect and unprotect.

(bug 48256) Make brackets in section edit links accessible to CSS. They are now wrapped in <span class="mw-editsection-bracket" />.

Change tags (used by the AbuseFilter extension) are now shown on diff pages.

Change tag lists (shown on recent changes, watchlist, user contributions, history pages, diff pages) now include a link to Special:Tags to distinguish them from edit summaries.

Added a new method and hook, User::isEveryoneAllowed() and UserIsEveryoneAllowed, for use in situations where a "does everyone have this right?" check is used to avoid more expensive checks.

(bug 14431) Display "(No difference)" instead of an empty diff (when comparing revisions in the history or when previewing changes while editing).

New hook 'IsUploadAllowedFromUrl' is added which can be used to intercept uploads by URL, useful for blacklisting specific URLs

(bug 21912) Watchlist token implementation has been refactored and Special:ResetTokens was added to allow users to reset their tokens instead of presenting them in Preferences.

Special:PrefixIndex now lets you strip the searched prefix from the displayed titles. Given a list of articles named Bug1, Bug2, you can now transclude the list of bug numbers using: {{Special:PrefixIndex/Bug|stripprefix=1}}. The special page form received a new checkbox matching that option.

(bug 47399) A success message is now displayed after changing the password.

Make thumb.php give HTTP redirects for file redirects

(bug 30607) Special:ListFiles can now show old versions of files. Additionally Special:AllMyUploads was introduced so the user can get a list of all things they have ever uploaded, even if it was subsequently overriden.

Introduced Special:MyFiles and Special:AllMyFiles as an alias for Special:MyUploads and Special:AllMyUploads respectively.

IPv6 addresses in X-Forwarded-For headers are now normalised before checking against allowed proxy lists.

Add deferrable update support for callback/closure.

Add TitleMove hook before page renames.

Revision deletion backend code is moved out of SpecialRevisiondelete

Added {{REVISIONSIZE}} variable to get the current size of a revision.

Add support for the LESS stylesheet language to ResourceLoader. LESS is a stylesheet language that compiles into CSS. ResourceLoader file modules may include LESS style files; ResourceLoader will compile these files into CSS before sending them to the client.

The $wgResourceLoaderLESSVars configuration variable is an associative array mapping variable names to string CSS values. These variables are considered declared for all LESS files. Additional variables may be registered by adding keys to the array.

$wgResourceLoaderLESSImportPaths is an array of file system paths. Files referenced in LESS '@import' statements are looked up here first.

ResourceLoader supports hashes as module cache invalidation trigger (instead of or in addition to timestamps).

Added $wgExtensionEntryPointListFiles for use in mergeMessageFileList.php.

Added a hook, APIQuerySiteInfoStatisticsInfo, to allow extensions to modify the output of the API query meta=siteinfo&siprop=statistics

Primary keys have been added to both the archive table and the externallinks tables.

Added $wgEnableParserLimitReporting to control whether the NewPP limit report is output in a HTML comment.

The 'UnwatchArticle' and 'WatchArticle' hooks now support a Status object instead of just a boolean return value to abort the hook.

Added a hook, SpecialWatchlistGetNonRevisionTypes, to allow extensions with custom recentchanges entries to hook into the Watchlist without clobbering each other.

A hidden, empty input field was added to the edit form, and any edit that fills it in will be rejected. This prevents against the simplest form of spambots. Previously in the "SimpleAntiSpam" extension by Ryan Schmidt.

$wgLogAutopatrol added to allow disabling logging of autopatrol edits in the logging table. default for $wgLogAutopatrol is true.

The 'edit' right no longer allows for editing a user's own CSS and JS.

New rights 'editmyusercss', 'editmyuserjs', 'viewmywatchlist', 'editmywatchlist', 'viewmyprivateinfo', 'editmyprivateinfo', and 'editmyoptions' restrict actions that were formerly allowed by default. They have been added to the default for $wgGroupPermissions['*'].

The 'editprotected' right no longer allows bypassing of all page protection restrictions. Any group using it for this purpose will now need to have all the individual rights listed in $wgRestrictionTypes for the same effect.

The 'protect' and 'autoconfirmed' rights are no longer used for the default page protection levels. The rights 'editprotected' and 'editsemiprotected' are now used for this purpose instead.

$wgNoFollowDomainExceptions now only matches entire domains. For example, an entry for 'bar.com' will still match 'foo.bar.com' but not 'foobar.com'.

$wgCopyUploadTimeout and $wgCopyUploadAsyncTimeout added to change the timeout times for fetching the file during upload by url.

New key added to $wgGalleryOptions - $wgGalleryOptions['mode'] to set default gallery mode.

New hook 'GalleryGetModes' to allow extensions to make new gallery modes.

The checkbox for staying in HTTPS displayed on the login form when $wgSecureLogin is enabled has been removed. Instead, whether the user stays in HTTPS will be determined based on the user's preferences, and whether they came from HTTPS or not.

$wgRC2UDPAddress, $wgRC2UDPInterwikiPrefix, $wgRC2UDPOmitBots, $wgRC2UDPPort, and $wgRC2UDPPrefix configuration options have been deprecated in favor of a $wgRCFeeds configuration array. $wgRCFeeds makes both the format and destination of recent change notifications customizable, and allows for multiple destinations to be specified.

(bug 53862) portal-url, currentevents-url and helppage have been removed from the default Sidebar.

The 'vector-simplesearch' preference is now enabled by default. Previously it was only enabled if the Vector extension was installed.

The precise format of metric datagrams produced by the UDP profiler and stats counter may now be specified as $wgUDPProfilerFormatString and $wgStatsFormatString, respectively.

(bug 54597) $wgBlockOpenProxies, $wgProxyPorts, $wgProxyScriptPath, and $wgProxyMemcExpiry have been removed, along with the open proxy scanner script they were added for.

Default value of $wgMaxShellMemory has been tripled (it's now 300 MB).

(bug 46749) Broken files tracking category removed from pages if an image with that name is uploaded.

(bug 14176) System messages that are empty were previously incorrectly treated as non-existent, causing a fallback to the default. This stopped users from overriding system messages to make them blank.

(bug 48319) action=parse no longer returns an error if passed none of 'oldid', 'pageid', 'page', 'title', and 'text' (e.g. if only passed 'summary'). A warning will instead be issued if 'title' is non-default, unless no props are requested.

Special:Recentchangeslinked will now include upload log entries

(bug 41281) Fixed ugly output if file size could not be extracted for multi-page media.

(bug 658) Converted the table of contents on wiki pages from <table> to <div> and adjusted skin CSS accordingly. The CSS was carefully crafted to be backwards-compatible in all reasonable cases (uses of the __TOC__ magic word, the #toc CSS id and the .toc CSS class). However, particularly bad abuse of the id or the class can possibly break.

CSSJanus now supports rgb, hsl, rgba, and hsla color syntaxes.

Special:Listfiles can no longer be sorted by image name when filtering by user in miser mode.

(bug 25553) The JSON output formatter now leaves forward slashes unescaped to improve human readability of URLs and similar strings. Also, a "utf8" option is now provided to use UTF-8 encoding instead of hex escape codes for most non-ASCII characters.

(bug 46626) xmldoublequote parameter was removed. Because of a bug, the parameter has had no effect since MediaWiki 1.16, and so its removal is unlikely to impact existing clients.

(bug 47216) action=query&meta=siteinfo&siprop=skins will now indicate which skin is the default and which are unusable (e.g. listed in $wgSkipSkins).

(bug 25325) Added support for wlshow filtering (bots/anon/minor/patrolled) to action=feedwatchlist.

WDDX formatted output will actually be formatted (and normal output will no longer be), and will no longer choke on booleans.

(bug 48129) list=blocks&bkip= now correctly handles IPv6 CIDR ranges and honors $wgBlockCIDRLimit. Note any clients passing invalid values to bkip will now receive an error, rather than the previous behavior listing all user blocks.

(bug 48201) action=parse&text=foo now assumes wikitext if no title is given, rather than using the content model of the page "API".

action=watch no longer silently ignores hook abort.

(bug 50785) action=purge with forcelinkupdate=1 no longer queues refreshLinks jobs in the job queue for link table updates of pages that use the given page as a template. Instead, forcerecursivelinkupdate=1 is introduced and should be used if that behaviour is desirable.

The 'debugLog' property (enabled by $wgDebugToolbar) no longer sets the log entry values through ApiResult::content but directly. This changes the JSON output from an array of objects with content in '*' to an array of strings with the content.

(bug 51342) prop=imageinfo iicontinue now contains the dbkey, not the text version of the title.

(bug 52538) action=edit will now use empty text instead of the contents of section 0 when passed prependtext or appendtext with section=new.

Support for the 'gettoken' parameter to action=block and action=unblock, deprecated since 1.20, has been removed.

(bug 49090) Token-getting functions will fail when using jsonp callbacks.

(bug 48276) MediaWiki will now flash a confirmation message upon successfully editing a page.

(bug 40785) mediawiki.legacy.ajax has been marked as deprecated. The following properties now emit mw.log.warn when accessed: sajax_debug, sajax_init_object, sajax_do_call and wfSupportsAjax.

Methods Title::userCanEditCssSubpage and Title::userCanEditJsSubpage, deprecated since 1.19, have been removed.

(bug 50134) Hook functions are no longer required to return a value. When a hook function does not return a value (or when it returns an explicit null), processing continues. To abort the hook, a hook function must return an explicit, boolean false or a string error message. Other falsey values are tantamount to a 'return true' in earlier versions of MediaWiki.

(bug 48256) The 'editsection-brackets' optional message was removed. Section edit links' brackets can now be customized using CSS by styling span.mw-editsection-bracket.

The usePatrol function in ChangesList has been marked as deprecated.

(bug 50785) A "null edit", that is, a save action in which no changes to the page text are made and no revision recorded, will no longer send refreshLinks jobs to the job table to update pages which use the edited page as a template.

The LivePreviewPrepare and LivePreviewDone events triggered on "jQuery( mw )" have been deprecated in favour of using mw.hook.

The 'showjumplinks' user preference has been removed, jump links are now always included.

Methods RecentChange::notifyRC2UDP, RecentChange::sendToUDP, and RecentChange::cleanupForIRC have been deprecated, as it is now the responsibility of classes implementing the RCFeedFormatter and RCFeedEngine interfaces to implement the formatting and delivery for recent change notifications.

SpecialPrefixindex methods namespacePrefixForm() and showPrefixChunk() have been made protected. They were accepting form variance arguments, this is now using properties in the SpecialPrefixindex class.

(bug 49629) The hook ExtractThumbParamaters has been deprecated in favour of media handler overriding MediaHandler::parseParamString.

(bug 46512) The collapsibleNav feature from the Vector extension has been moved to the Vector skin in core.

SpecialRecentChanges::addRecentChangesJS() function has been renamed to addModules() and made protected.

Methods WatchAction::doWatch and WatchAction::doUnwatch now return a Status object instead of a boolean.

Information boxes (CSS classes errorbox, warningbox, successbox) have been made more subtle.

Code specific to the Math extension was marked as deprecated.

mediawiki.util: mw.util.wikiGetlink has been renamed to getUrl. (The old name still works, but is deprecated.)

1.22 has several database changes since 1.21, and will not work without schema updates. Note that due to changes to some very large tables like the revision table, the schema update may take quite long (minutes on a medium sized site, many hours on a large site).

If upgrading from before 1.11, and you are using a wiki as a commons repository, make sure that it is updated as well. Otherwise, errors may arise due to database schema changes.

If upgrading from before 1.7, you may want to run refreshLinks.php to ensure new database fields are filled with data.

If you are upgrading from MediaWiki 1.4.x or earlier, you should upgrade to 1.5 first. The upgrade script maintenance/upgrade1_5.php has been removed with MediaWiki 1.21.

Documentation for both end-users and site administrators is available on MediaWiki.org, and is covered under the GNU Free Documentation License (except for pages that explicitly state that their contents are in the public domain):